Scottish police acted with complete disregard for human rights and privacy rules when investigating and attempting to track the sources of journalists, according to the British Communications Commissioner's Office (IOCCO).
The commission says even pretending they were acting under anti-terrorism powers without a warrant is "reckless".
Commissioner Sir Stanley Burnton says, "Police Scotland sought communications data in order to determine either a journalist's source, or the communications of those suspected to have been acting as intermediaries between a journalist and a suspected source. Judicial approval was not obtained to acquire this communications data."
He added "The failures identified can properly be viewed as reckless."
Sir Burton ordered an investigation into Police Scotland after allegations emerged it was targeting journalists at the Scottish Sunday Mail to identify a whistleblower within its ranks.
In a released statement, Police Scotland confirmed "that it did not adhere to the new guidelines covering access to communications data during a recent investigation into alleged serious breaches of information security".
"We also acknowledge the deficiencies in the applications themselves, which have been highlighted by IOCCO," reads the statement.
Sir Burnton says Police Scotland has now established "significant measures in order to prevent any recurrence of such contraventions." The findings of the investigation come at the same time as the government released its draft Investigatory Powers Bill.
The bill seeks to make it illegal for security services to acquire bulk collections of communications data.
Security services will also need to obtain a warrant to bug computers and phones. Once a warrant has been obtained, companies will be legally obliged to “assist these operations and bypass encryption where possible”.
Oversight for these operations will require a new “double-lock” where any intercept warrants will need ministerial authorization before finally being approved by a panel of judges, who will have the power of veto. The panel will be overseen by a yet to be appointed Investigatory Powers Commissioner.